Stateless Deterministic NAT (SD-NAT)
Description: Stateless Deterministic NAT (SD-NAT) draft-penno-softwire-sdnat-01 Reinaldo Penno (rpennojuniper.net) Olivier Vautrin (olivierjuniper.net) Alain Durand (adurandjuniper.net) November 2011 Motivation Issues with current Stateless
Related Topics
Download Presentation
"Stateless Deterministic NAT (SD-NAT)" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Presentation Transcript
slide1. Stateless Deterministic NAT (SD-NAT) draft-penno-softwire-sdnat-01 Reinaldo Penno (rpenno@juniper.net)
Olivier Vautrin (olivier@juniper.net)
Alain Durand (adurand@juniper.net)
November 2011<br>
slide2. Motivation Issues with current Stateless solutions:
Those mapping approach requires an IPv6 access network and an IPv6 capable CPE.
Tying IPv6 and IPv4 address reduce flexibility in managing IPv4 pool: add/deletion of IPv4 resources require IPv6 renumbering.
Require an important CPE modification. Recent History has shown that it is the most difficult part.<br>
slide3. Time Crunch Time is the enemy of Stateless solutions:
Once CGNs are deployed, no reason to move away from them (CPE investment, Ipv6 access)
Ratio Users/IP increasing, Stateless will become less attractive
CGN Smooth upgrade to SD-NAT:
No CPE upgrade
No Ipv6/Re-addressing needed
Easy Mixed of CGN/SD-NAT<br>
slide4. SP access Customer Premises Port mapping on SD-CPE 1024 65535 Host 1 Host 2 Host 3 Host n 1024 65535 Internal Hosts SD-CPE<br>
slide5. Port mapping on SD-CGN or SD-AFTR 1024 65535 IPv4 address 1 IPv4 address 2 IPv4 address 3 IPv4 address n IPv4 address n+1 1024 65535 SD-CPE x SD-CGN or SD-AFTR 1024 65535 SD-CPE y SD-CGN or SD- AFTR is stateless. A simple formula maps inside and outside ports. SP core SP access<br>
slide6. CPE Modification Example on Linux based CPE (DD-WRT, …)
/lib/firewall/uci_firewall.sh
OLD:
$IPTABLES -I zone_${zone}_nat 1 -t nat -o "$ifname" -j MASQUERADE
NEW:
$IPTABLES -I zone_${zone}_nat 1 -t nat -o "$ifname" -j MASQUERADE -p tcp --to-ports 1024-2023<br>
slide7. SD-NAT in a nutshell Stateless operation on CGN
No Logs, No State, Easy Redundancy, Low delay
Minimal CPE modification
CPE chooses outgoing SRC ports to fit into a well-known range [1024-MaxPort]
CPE can been configured with MaxPort (eg TR69)
Alternatively, the CPE can dynamically discover MaxPort.
That’s it! No IPv6 requirements, no complex IPv4/IPv6 mapping.
Flexibility
Easily add/remove IPv4 global addresses from NAT pool without renumbering the access network.
Access Network can be IPv4.
Can work with an IPv6 access network (Very similar to DS-Lite).<br>
slide8. Time Crunch Time is the enemy of Stateless solutions:
Once CGNs are deployed, no reason to move away from them (CPE investment, Ipv6 access)
Ratio Users/IP increasing, Stateless will become less attractive
CGN Smooth upgrade to SD-NAT:
No CPE upgrade
No Ipv6/Re-addressing needed
Easy Mixed of CGN/SD-NAT<br>
slide9. Thank you Questions?<br>
Olivier Vautrin (olivier@juniper.net)
Alain Durand (adurand@juniper.net)
November 2011<br>
slide2. Motivation Issues with current Stateless solutions:
Those mapping approach requires an IPv6 access network and an IPv6 capable CPE.
Tying IPv6 and IPv4 address reduce flexibility in managing IPv4 pool: add/deletion of IPv4 resources require IPv6 renumbering.
Require an important CPE modification. Recent History has shown that it is the most difficult part.<br>
slide3. Time Crunch Time is the enemy of Stateless solutions:
Once CGNs are deployed, no reason to move away from them (CPE investment, Ipv6 access)
Ratio Users/IP increasing, Stateless will become less attractive
CGN Smooth upgrade to SD-NAT:
No CPE upgrade
No Ipv6/Re-addressing needed
Easy Mixed of CGN/SD-NAT<br>
slide4. SP access Customer Premises Port mapping on SD-CPE 1024 65535 Host 1 Host 2 Host 3 Host n 1024 65535 Internal Hosts SD-CPE<br>
slide5. Port mapping on SD-CGN or SD-AFTR 1024 65535 IPv4 address 1 IPv4 address 2 IPv4 address 3 IPv4 address n IPv4 address n+1 1024 65535 SD-CPE x SD-CGN or SD-AFTR 1024 65535 SD-CPE y SD-CGN or SD- AFTR is stateless. A simple formula maps inside and outside ports. SP core SP access<br>
slide6. CPE Modification Example on Linux based CPE (DD-WRT, …)
/lib/firewall/uci_firewall.sh
OLD:
$IPTABLES -I zone_${zone}_nat 1 -t nat -o "$ifname" -j MASQUERADE
NEW:
$IPTABLES -I zone_${zone}_nat 1 -t nat -o "$ifname" -j MASQUERADE -p tcp --to-ports 1024-2023<br>
slide7. SD-NAT in a nutshell Stateless operation on CGN
No Logs, No State, Easy Redundancy, Low delay
Minimal CPE modification
CPE chooses outgoing SRC ports to fit into a well-known range [1024-MaxPort]
CPE can been configured with MaxPort (eg TR69)
Alternatively, the CPE can dynamically discover MaxPort.
That’s it! No IPv6 requirements, no complex IPv4/IPv6 mapping.
Flexibility
Easily add/remove IPv4 global addresses from NAT pool without renumbering the access network.
Access Network can be IPv4.
Can work with an IPv6 access network (Very similar to DS-Lite).<br>
slide8. Time Crunch Time is the enemy of Stateless solutions:
Once CGNs are deployed, no reason to move away from them (CPE investment, Ipv6 access)
Ratio Users/IP increasing, Stateless will become less attractive
CGN Smooth upgrade to SD-NAT:
No CPE upgrade
No Ipv6/Re-addressing needed
Easy Mixed of CGN/SD-NAT<br>
slide9. Thank you Questions?<br>